chore(deps): update fro-bot/agent to v0.98.4

[fro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	patch	v0.98.3 → v0.98.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

fro-bot/agent (fro-bot/agent)

v0.98.4

Compare Source

What's new

Session state now survives across mention-triggered runs. Previously, issue_comment and issues events receive a read-only Actions cache token, so every write was silently denied — the agent reported "Cache saved" but nothing persisted, and each mention started cold. This release wires an S3 backend as durable storage for those triggers, restoring continuity without touching the pull_request path, which already had a writable token and is left unchanged.

Two non-obvious wiring details shaped the implementation. Credentials are resolved through the ambient AWS SDK chain rather than action inputs, and AWS_* variables are filtered from the agent child process so the model's bash never sees them. The SSE encryption type is set explicitly to aws:s3 — left unset, the SDK defaults to aws:kms, which would fail against a bucket with no KMS grants in its IAM policy. Both details, along with the full four-action IAM policy required (s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket — the list action being necessary for restore and its absence otherwise causing a silent cold-start), are now documented. #​1381

Two operational learnings from the S3 work are captured in docs/solutions/. The first covers how an IAM policy derived only from the save path silently disables restore: adapter.list returns a Result rather than throwing, so a denied ListObjectsV2 logs one warning and reports the store empty — the run stays green and sessions start cold indefinitely. The second documents the architectural reason a mention-triggered run cannot clear a CHANGES_REQUESTED review: resolveResponseSurface keys the output surface off the triggering event, and allowing a comment-initiated run to unblock a PR would make review dismissal one comment away for anyone who can comment. #​1383

The living documentation (README, ARCHITECTURE, STRUCTURE, SECURITY) was refreshed to reflect the S3-first restore and Actions cache fallback ordering, the correct four-action IAM policy, the coordination-lock architecture, and the current workflow inventory and trigger coverage. #​1384

Full changelog

0.98.4 (2026-08-12)

Build System

• deps: update Node.js to v24.19.0 (#​1372) (b917197)

Bug Fixes

• deps: update dependency @​aws-sdk/client-s3 to v3.1106.0 (#​1379) (b997440)
• deps: update dependency effect to v3.22.1 (#​1329) (502e7a9)

Documentation

• refresh living documentation (#​1384) (1c1c2fa)
• solutions: capture two learnings from wiring durable session storage (#​1383) (51a9325)

Continuous Integration

• deps: update bfra-me/.github to v4.16.45 (#​1363) (108e1cd)
• deps: update dependency npm to v11.19.0 (#​1378) (35dc537)
• workflow: wire durable S3 session storage (#​1381) (d32d7e6), closes #​1370 #​1373

Miscellaneous Chores

• deps: update dependency step-security/harden-runner to v2.20.1 (#​1325) (63f80bd)
• deps: update dependency vite to v8.2.1 (#​1375) (a4756d6)
• dev: update dependency @​vitest/eslint-plugin to v1.6.26 (#​1327) (f556c75)
• dev: update dependency eslint to v10.8.1 (#​1377) (1db91b5)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.